CVE Feed

    Dashboard / CVE / CVE-2026-69203

    CVE-2026-69203

    Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client through server-initiated PUSH_PROMISE frames because enablePush is not enforced. This issue is fixed in versions 0.23.35 and 1.0.0-M47.

    Published:Sep 15, 2026
    Last Modified:Sep 15, 2026
    EPS:Sep 15, 2026
    EPSS Score:
    CVSS Score:7.5

    Affected Products

    Vendor
    Http4s
    Product
    Http4s

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-88975 (CVSS 7.5) — Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses…
    CVE-2026-69206 (CVSS 5.9) — Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection re…
    CVE-2026-69202 (CVSS 7.5) — Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control win…
    CVE-2026-69218 (CVSS 7.5) — Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 H…
    CVE-2026-69217 (CVSS 8.7) — Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts…
    CVE-2026-69210 (CVSS 7.5) — Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyL…
    CVE-2026-69215 (CVSS 6.8) — Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware…
    CVE-2026-69205 (CVSS 8.7) — Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a ca…
    CVE-2026-69212 (CVSS 5.9) — Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middl…
    CVE-2026-69213 (CVSS 7.5) — Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outboun…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High